CVE-2015-2209: Exposure of Sensitive Information to an Unauthorized Actor

DLGuard 4.5 allows remote attackers to obtain the installation path via the c parameter to index.php...

Webshop Hun 1.062S SQL Injection

Webshop hun v1.062S SQL Injection Security Vulnerabilities Exploit Title: Webshop hun v1.062S /index.php Multiple Parameters SQL Injection Security Vulnerabilities Product: Webshop hun Vendor: Webshop hun Vulnerable Versions: v1.062S Tested Version: v1.062S Advisory Publication: Mar 04, 2015 Late...

Webshop Hun 1.062S Cross Site Scripting

Webshop hun v1.062S XSS Cross-site Scripting Security Vulnerabilities Exploit Title: Webshop hun v1.062S /index.php Multiple Parameters XSS Security Vulnerabilities Product: Webshop hun Vendor: Webshop hun Vulnerable Versions: v1.062S Tested Version: v1.062S Advisory Publication: Mar 04, 2015...

PT-2015-5663

Name of the Vulnerable Software and Affected Versions DLGuard version 4.5 Description The issue allows remote attackers to obtain the installation path. This is achieved via the c parameter to the "index.php" endpoint. Recommendations For DLGuard version 4.5, consider restricting access to the...

DLGuard SQL Injection Vulnerability

DLGuard is a complete sales and customer management system used to protect and streamline online business. A SQL injection vulnerability exists in DLGuard version 4.5, which stems from the index.php script failing to adequately filter the 'c' parameter. A remote attacker can exploit this...

Sql injection

SQL injection vulnerability in DLGuard 4.5 allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php...

CVE-2015-2064

Multiple cross-site scripting XSS vulnerabilities in DLGuard 5, 4.6, and 4.5 allow remote attackers to inject arbitrary web script or HTML via the 1 page, 2 c, or 3 redirect parameter to index.php or 4 search field searchTerm parameter in the main page...

CVE-2015-2064

Multiple cross-site scripting XSS vulnerabilities in DLGuard 5, 4.6, and 4.5 allow remote attackers to inject arbitrary web script or HTML via the 1 page, 2 c, or 3 redirect parameter to index.php or 4 search field searchTerm parameter in the main page...

CVE-2015-2066: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in DLGuard 4.5 allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php...

CVE-2015-2064: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in DLGuard 5, 4.6, and 4.5 allow remote attackers to inject arbitrary web script or HTML via the 1 page, 2 c, or 3 redirect parameter to index.php or 4 search field searchTerm parameter in the main page...

PT-2015-5579

Name of the Vulnerable Software and Affected Versions DLGuard version 4.5 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the c parameter in the "index.php" endpoint. Recommendations For DLGuard version 4.5, consider...

PT-2015-5577

Name of the Vulnerable Software and Affected Versions DLGuard versions 4.5 through 5 Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters, including the page, c, or redirect parameter to index.php, or the searchTerm parameter in the main...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, the 2 src parameter in a none action to index.php, or the 3 "First...

CVE-2014-8690

Multiple cross-site scripting XSS vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, the 2 src parameter in a none action to index.php, or the 3 "First...

CVE-2015-1603

Multiple cross-site scripting XSS vulnerabilities in Adminsystems CMS before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter to index.php or 2 id parameter in a usersusers action to asys/site/system.php...

CVE-2015-1603

Multiple cross-site scripting XSS vulnerabilities in Adminsystems CMS before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter to index.php or 2 id parameter in a usersusers action to asys/site/system.php...

CVE-2014-8690: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, the 2 src parameter in a none action to index.php, or the 3 "First...

CVE-2015-1603: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Adminsystems CMS before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter to index.php or 2 id parameter in a usersusers action to asys/site/system.php...

PT-2015-5383

Name of the Vulnerable Software and Affected Versions Adminsystems CMS versions prior to 4.0.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the page parameter to "index.php" or the id parameter in a "users users" action to...

PT-2015-5371

Name of the Vulnerable Software and Affected Versions Maarch LetterBox versions 2.8 and earlier GEC/GED versions 1.4 and earlier Description The issue allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a request to a predictable...